OK, I think I'm satisfied that there isn't a security concern, thank you @rgarner for doing the investigating :mag:  

@issyl0 let's ditch `value.exclude?('<script>')` and the related spec.